When we implement a specific service based on Docker, we usually configure the service by running an application in a container environment. Further research is needed to detect such attacks from a container network perspective. In addition, as an attacker can enter the Docker container environment through the Docker API exposed on the Internet, the attacker can bypass the security program and execute various secondary attacks. In the case of applications that are used by multiple users and acquire special privileges, such as Portainer, a web GUI tool to facilitate Docker container management, various attacks can occur in the Docker container environment.

They mainly infiltrate Docker container environments through misconfigured APIs for the purpose of DDoS or cryptocurrency mining. However, security threats targeting Docker containers began to increase with the activities of malicious hacker teams such as TeamTNT, WatchDog, Kinsing, and Rocke. In addition, by examining the attacks from the network perspective of the Docker container environment, we lay the groundwork for detecting and preventing lateral movement attacks that may occur between the Docker containers.ĭocker, an open-source platform used to package and run applications as containers, has become an important platform used by more than half of developers for reasons such as software portability, application operation standardization, and efficient resource management. In this paper, we experiment with cyberattacks such as ARP spoofing, DDoS, and elevation of privilege attacks to show how attackers can execute various attacks and analyze the results in terms of network traffic, CPU consumption, and malicious reverse shell execution. Docker provides communication between multiple containers through internal network configuration, which makes it easier to configure various services by logically connecting containers to each other, but cyberattacks exploiting the vulnerabilities of the Docker container network, e.g., distributed denial of service (DDoS) and cryptocurrency mining attacks, have recently occurred. It is in the limelight especially at companies and IT developers that provide cloud services thanks to its advantages such as the portability of applications and being lightweight. Docker has become widely used as an open-source platform for packaging and running applications as containers.

Wireshark ubuntu 20.04